Liebe Gemeinde, beim Herunterfahren (MacBook Pro OS 10.9.5) habe ich immer eine Meldung, in der ich gefragt werde, ob ich die Installation beenden möchte oder abbrechen (abort). Manchmal habe ich genug Zeit, "abort" zu drücken, das Fenster verrät mir aber nicht, um welche Installation es sich überhaupt handelt. Kann ich das irgendwo beobachten? Im Terminal?
Danke schön für jeden Versuch von euch!

Eventuell genieo: wie man es los wird steht hier: http://www.thesafemac.com/arg-genieo/

wo der verdacht auf sowas ist, ist oftmals noch viel mehr...
ich wäre an einem log von etrecheck interessiert,

War ein guter Verdacht, das mit diesem genieo, danke.
Hier das Protokoll von EtreCheck:

EtreCheck version: 2.6.3 (223)
Report generated 13.11.15 20:53
Runtime 8:54
Download EtreCheck from http://etresoft.com/etrecheck

Click the [Click for support] links for help with non-Apple products.
Click the [Click for details] links for more information about that line.
Click the [Click to remove] links for help removing adware.

Hardware Information: (What does this mean?)
MacBook Pro (15-inch, Late 2008)
[Click for Technical Specifications]
[Click for User Guide]
MacBook Pro - model: MacBookPro5,1
1 2.53 GHz Intel Core 2 Duo CPU: 2-core
8 GB RAM Upgradeable
[Click for upgrade instructions]
BANK 0/DIMM0
4 GB DDR3 1067 MHz ok
BANK 0/DIMM1
4 GB DDR3 1067 MHz ok
Bluetooth: Old - Handoff/Airdrop2 not supported
Wireless: en1: 802.11 a/b/g/n
Battery: Health = Replace Soon - Cycle count = 684 - SN = 6N84126R13EB

Video Information: (What does this mean?)
NVIDIA GeForce 9400M - VRAM: 256 MB
Color LCD 1440 x 900
NVIDIA GeForce 9600M GT - VRAM: 512 MB

System Software: (What does this mean?)
OS X Mavericks 10.9.5 (13F1134) - Time since boot: less than an hour

Disk Information: (What does this mean?)
ST1000LM024 HN-M101MBB disk0 : (1 TB) (Rotational)
EFI (disk0s1) <not mounted> : 210 MB
Macintosh HD (disk0s2) / : 888.94 GB (257.51 GB free)
Recovery HD (disk0s3) <not mounted> [Recovery]: 650 MB
Part 2 (disk0s4) /Volumes/Part 2 : 109.76 GB (21.46 GB free)
Recovery HD (disk0s5) <not mounted> [Recovery]: 650 MB

MATSHITADVD-R UJ-868 ()

USB Information: (What does this mean?)
Apple Inc. Built-in iSight
Apple Inc. BRCM2046 Hub
Apple Inc. Bluetooth USB Host Controller
Apple, Inc. Apple Internal Keyboard / Trackpad
Apple Computer, Inc. IR Receiver
Wacom Co.,Ltd. CTH-460

Gatekeeper: (What does this mean?)
Mac App Store and identified developers

Adware: (What does this mean?)
Genieo, InstallMac Adware! [Click to remove]
More adware files Adware! [Click to remove]

Kernel Extensions: (What does this mean?)
/System/Library/Extensions
[loaded] com.AmbrosiaSW.AudioSupport (4.1.2 - SDK 10.7) [Click for support]
[loaded] com.Cycling74.driver.SAVD (1.0.0d1 - SDK 10.6) [Click for support]
[loaded] com.Cycling74.driver.Soundflower (1.6.6 - SDK 10.6) [Click for support]
[not loaded] com.ZTE.driver.ZTEUSBCDCACMData (1.3.8) [Click for support]
[not loaded] com.ZTE.driver.ZTEUSBMassStorageFilter (1.3.8) [Click for support]
[not loaded] com.cisco.kext.acsock (1.1.0 - SDK 10.2) [Click for support]
[not loaded] com.novatelwireless.kext.wwan (3.0.15) [Click for support]
[not loaded] com.olympus.DSSBlockCommandsDevice (1.1.0) [Click for support]
[not loaded] com.option.driver.OptionHS (3.31.0) [Click for support]
[not loaded] com.option.driver.OptionMSD (1.22.0) [Click for support]
[not loaded] com.sierrawireless.driver.SierraDIPSupport (1.0.0) [Click for support]
[not loaded] com.sierrawireless.driver.SierraDevSupport (1.0.7) [Click for support]
[not loaded] com.sierrawireless.driver.SierraFSRSupport (3.0.0) [Click for support]
[not loaded] com.sierrawireless.driver.SierraHSRSupport (3.0.0) [Click for support]
[not loaded] com.sierrawireless.driver.SierraIPDirect (1.1.3) [Click for support]
[not loaded] com.wacom.kext.pentablet (5.3.0 - SDK 10.8) [Click for support]
[not loaded] com.wacom.kext.wacomtablet (6.1.5) [Click for support]

/System/Library/Extensions/NovatelWirelessWWAN.kext/Contents/PlugIns
[not loaded] com.NovatelWireless.driver.NovatelWirelessUSBCDCECMControl (3.0.15) [Click for support]
[not loaded] com.NovatelWireless.driver.NovatelWirelessUSBCDCECMData (3.0.15) [Click for support]
[not loaded] com.novatelwireless.driver.3G (3.0.15) [Click for support]
[not loaded] com.novatelwireless.driver.3GData (3.0.15) [Click for support]
[not loaded] com.novatelwireless.driver.DisableAutoInstall (3.0.15) [Click for support]
[not loaded] com.novatelwireless.driver.NWVBE (3.0.15) [Click for support]

Launch Agents: (What does this mean?)
[loaded] com.adobe.AAM.Updater-1.0.plist [Click for support]
[loaded] com.adobe.CS4ServiceManager.plist [Click for support]
[loaded] com.adobe.CS5ServiceManager.plist [Click for support]
[loaded] com.cisco.anyconnect.gui.plist [Click for support]
[running] com.deploystudio.ksmbprintd.plist [Click for support]
[loaded] com.oracle.java.Java-Updater.plist [Click for support]
[running] com.wacom.pentablet.plist [Click for support]
[running] com.wacom.wacomtablet.plist [Click for support]
[running] net.culater.SIMBL.Agent.plist [Click for support]
[loaded] org.macosforge.xquartz.startx.plist [Click for support]

Launch Daemons: (What does this mean?)
[loaded] com.adobe.SwitchBoard.plist [Click for support]
[loaded] com.adobe.fpsaud.plist [Click for support]
[loaded] com.ambrosiasw.ambrosiaaudiosupporthelper.daemon.plist [Click for support]
[loaded] com.bombich.ccc.plist [Click for support]
[running] com.cisco.anyconnect.vpnagentd.plist [Click for support]
[loaded] com.microsoft.office.licensing.helper.plist [Click for support]
[loaded] com.oracle.java.Helper-Tool.plist [Click for support]
[loaded] com.oracle.java.JavaUpdateHelper.plist [Click for support]
[loaded] com.sierrawireless.SWoCTool.plist [Click for support]
[running] com.sonos.SonosLibraryServer.plist [Click for support]
[loaded] org.macosforge.xquartz.privileged_startx.plist [Click for support]
[loaded] phonostarTimer.plist [Click for support]

User Launch Agents: (What does this mean?)
[loaded] XSManager [Click for support]
[loaded] com.citrixonline.GoToMeeting.G2MUpdate.plist [Click for support]
[loaded] com.genieo.completer.download.plist Adware! [Click to remove]
[loaded] com.genieo.completer.ltvbit.plist Adware! [Click to remove]
[running] com.genieo.completer.update.plist Adware! [Click to remove]
[loaded] com.google.keystone.agent.plist [Click for support]
[failed] com.wondershare.mobilegodaemon.plist [Click for support]
[loaded] de.metaquark.appfresh.plist [Click for support]
[loaded] de.phase6.reminder.agent.plist [Click for support]

User Login Items: (What does this mean?)
smb UNKNOWN (missing value)
MCXMenuExtraTool Programm (/System/Library/CoreServices/ManagedClient.app/Contents/Resources/MCXMenuExtraTool.app)
Stickies Programm Hidden (/Applications/Stickies.app)
SpeechSynthesisServer Programm (/System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/SpeechSynthesis.framework/Versions/A/SpeechSynthesisServer.app)
Alfred 2 Programm Hidden (/Applications/Alfred 2.app)

Other Apps: (What does this mean?)
[running] [0x0-0x6f06f].com.etresoft.EtreCheck
[running] com.runningwithcrayons.Alfred-2.242032
[running] com.wacom.Consumer_TouchDriver.11296
[running] com.wacom.TabletDriver.9184
[running] eu.mihosoft.sonoair.248544
[running] jp.co.canon.cijscannerregister.65856

Internet Plug-ins: (What does this mean?)
WacomNetscape: Version: 2.1.0-1 - SDK 10.8 [Click for support]
Google Earth Web Plug-in: Version: 6.0 [Click for support]
Default Browser: Version: 537 - SDK 10.9
Flip4Mac WMV Plugin: Version: 2.4.0.11 [Click for support]
OfficeLiveBrowserPlugin: Version: 12.2.8 [Click for support]
WacomTabletPlugin: Version: WacomTabletPlugin 2.1.0.2 [Click for support]
Silverlight: Version: 5.1.30514.0 - SDK 10.6 [Click for support]
FlashPlayer-10.6: Version: 19.0.0.245 - SDK 10.6 [Click for support]
Flash Player: Version: 19.0.0.245 - SDK 10.6 [Click for support]
QuickTime Plugin: Version: 7.7.3
iPhotoPhotocast: Version: 7.0 - SDK 10.8
SharePointBrowserPlugin: Version: 14.5.7 - SDK 10.6 [Click for support]
GarminGpsControl: Version: 2.9.3.0 Release [Click for support]
JavaAppletPlugin: Version: Java 8 Update 60 build 27 Check version

User internet Plug-ins: (What does this mean?)
CitrixOnlineWebDeploymentPlugin: Version: 1.0.105 [Click for support]

Safari Extensions: (What does this mean?)
Widgets
StumbleUpon
Ultimate Status Bar
Translate
Ticker Tool
DoNotTrackMe
Facebook Cleaner
FastestTube
Browser-Add-on zur Deaktivierung von Google Analytics
VimeoEmbiggener
YouTube5
Awesome Screenshot
SafariRestore
ClickToFlash
Print Plus

3rd Party Preference Panes: (What does this mean?)
PenTablet [Click for support]
Device Detector [Click for support]
Flash Player [Click for support]
Flip4Mac WMV [Click for support]
HP Scanners [Click for support]
Java [Click for support]
Perian [Click for support]
TeXDistPrefPane [Click for support]

Time Machine: (What does this mean?)
Skip System Files: NO
Mobile backups: ON
Auto backup: YES
Volumes being backed up:
Macintosh HD: Disk size: 888.94 GB Disk used: 631.43 GB
Destinations:
LaCie1TB [Local]
Total size: 999.86 GB
Total number of backups: 11
Oldest backup: 22.11.13 16:43
Last backup: 07.05.15 13:25
Size of backup disk: Too small
Backup size 999.86 GB < (Disk used 631.43 GB X 3)

Iomega_1TB [Local]
Total size: 999.12 GB
Total number of backups: 13
Oldest backup: 14.09.15 16:09
Last backup: 10.11.15 11:37
Size of backup disk: Too small
Backup size 999.12 GB < (Disk used 631.43 GB X 3)

Top Processes by CPU: (What does this mean?)
3% WindowServer
1% apsd
1% fontd
0% SonoAir
0% mDNSResponder

Top Processes by Memory: (What does this mean?)
1.40 GB com.apple.WebKit.WebContent(14)
686 MB kernel_task
418 MB mds_stores
246 MB com.apple.IconServicesAgent
188 MB Safari

Virtual Memory Information: (What does this mean?)
3.06 GB Free RAM
4.94 GB Used RAM (2.23 GB Cached)
0 B Swap Used

Diagnostics Information: (What does this mean?)
Nov 13, 2015, 08:26:14 PM Self test - passed
Nov 11, 2015, 11:41:45 AM ~/Library/Logs/DiagnosticReports/SIMBL Agent_2015-11-11-114145_[redacted].crash

Standard users cannot read /Library/Logs/DiagnosticReports.
Run as an administrator account to see more information.

jau. da ist ordentlich was los.

genieo ist auf jeden fall drauf. das volle programm.
ebenfalls installmac. auch eine malware.
(ich frag mich immer, wie einem sowas nicht selbst auffallen kann. das muss doch ständig rumnerven beim surfen.)

darüber hinaus hast du ganz schön viele kernelextension installiert. nutzt du die tatsächlich alle?
dann ist SIMBL installiert. das ist ein safari hack, der mindestens diskussionswürdig ist.

"awesome screenshot" in deinen browser-plugins ist ebenfalls malware.

perian funktioniert seit einigen os x versionen eh nicht mehr, kann also weg.

Und wie kriegt man die jetzt weg?

Naja, das einzige, was nervt, ist das langsame Safari, das habe ich aber beheben können und diese Meldung beim Runterfahren.
Woran könnte mir das mit InstallMac auffallen?
Die Kernelext. kommen mir teilweise bekannt vor, manche aber auch nicht, zB sierrawireless. Kann ich einfach löschen ...?

nach möglichkeit beim hersteller gucken ob es einen deinstaller gibt und/oder zumindest eine anleitung, wie man es korrekt deinstallieren soll.

für die adware kannst du mal den adware medic von thesafemac durchlaufen lassen.

Danke John, ich werde mich mal drum kümmern. Schön, dass es so Menschen wir dich gibt! Schönen Abend noch!

Den gibt es mittlerweile nicht mehr, heißt jetzt >> Malwarebytes >

(1) «What is Malwarebytes Anti Malware for Mac? Is this safe?» →

(2) «Stop pop-up ads and adware in Safari - Apple Support» →

Und natürlich unbedingt den MacKeeper!